1

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> Settings -> Passwords and accounts) because of convenience. I have read here

Browser password manager vs third party password manager

that built-in password managers in browsers are likely not as good a choice as third party ones when it comes to security. Therefore I am wondering if third-party password managers should be preferred on iOS as well.

My question:
Is there a difference in security between the built-in password manager in iOS 12 compared to third party password manager apps like Keepass, Lastpass, 1password, etc.?

0

Overall I think the built-in password manager can be an improvement in terms of security for many casual users.

First of all, it removes another party from the trust chain. You don't have to worry about the credibility of a third party for acting responsible with your data anymore. If you don't trust iOS for securely managing your passwords, you shouldn't trust iOS at all because it already has access to these and even more critical information.

Also, the password manager can use more of the security features of the device like the secure enclave for protecting the password storage. (This is already the case as far as I know)

But of course, the security of this feature also depends on the configuration of your device. If it's not properly hardened, even more information is at risk because the access control to the password manager is done with either your pass code or biometry.

Another disadvantage is the fact, that it's currently not possible to export the stored credentials for usage in other software. While this is not directly security related, it has impact on the usability which can lead to bad practices which are weakening the security of the system.

For example, when one changes the password of a service on the iOS device, they also need to change it manually on the desktop. This could be a painful task when the password is randomly generated. The consequence could be, that users stop using random and/or complex passwords or even stop using this feature at all. The other way would be that users stop using the other devices because of this. This would result in a vendor lock-in. (Which I consider very bad because for me, sustainability is a part of security) While the export to a file might be implemented in the future, I highly doubt that Apple will implement a feature which allows 3rd party software to sync the data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.